CVE-2025-66524
Last modified
CVE-2025-66524 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for storing and retrieving state information. The GetAsanaObject Processor used generic Java Object serialization and deserialization without filtering. EPSS estimates a 0.43% chance of exploitation in the next 30 days.
Description
Apache NiFi 1.20.0 through 2.6.0 include the GetAsanaObject Processor, which requires integration with a configurable Distribute Map Cache Client Service for storing and retrieving state information. The GetAsanaObject Processor used generic Java Object serialization and deserialization without filtering. Unfiltered Java object deserialization does not provide protection against crafted state information stored in the cache server configured for GetAsanaObject. Exploitation requires an Apache NiFi system running with the GetAsanaObject Processor, and direct access to the configured cache server. Upgrading to Apache NiFi 2.7.0 is the recommended mitigation, which replaces Java Object serialization with JSON serialization. Removing the GetAsanaObject Processor located in the nifi-asana-processors-nar bundle also prevents exploitation.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:L/U:Green
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Apache | Nifi | >= 1.20.0, < 2.7.0 | — |
| Apache | Nifi | 2.7.0 | Rc1 |
References
- https://lists.apache.org/thread/k9h004ydjg7opdvxr0nfywtzf33z60d7Issue Tracking, Mailing List, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-66524?
How severe is CVE-2025-66524?
How do I fix CVE-2025-66524?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-66519A stored cross-site scripting (XSS) vulnerability exists in …5.4
- CVE-2025-6652PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Infor…3.3
- CVE-2025-66520A stored cross-site scripting (XSS) vulnerability exists in …5.4
- CVE-2025-66521A stored cross-site scripting (XSS) vulnerability exists in …5.4
- CVE-2025-66522A stored cross-site scripting (XSS) vulnerability exists in …5.4
- CVE-2025-66523URL parameters are directly embedded into JavaScript code or…6.1
- CVE-2025-66525Missing Authorization vulnerability in Elastic Email Elastic…4.3
- CVE-2025-66526Missing Authorization vulnerability in Essekia Tablesome tab…4.3
- CVE-2025-66527Missing Authorization vulnerability in VanKarWai Lobo lobo a…4.3
- CVE-2025-66528Missing Authorization vulnerability in VillaTheme Thank You …4.3
- CVE-2025-66529Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro C…4.3
- CVE-2025-6653PDF-XChange Editor PRC File Parsing Out-Of-Bounds Read Infor…3.3
Are you affected by CVE-2025-66524?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST